Analysis
-
max time kernel
36s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe
Resource
win10v2004-20240802-en
General
-
Target
4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe
-
Size
896KB
-
MD5
25b4bdac7c75f4bf28b9dc09a3071d52
-
SHA1
766af599eda439aa3ddfa476adafb1fbd78f3a8a
-
SHA256
4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09
-
SHA512
1ccb051367026d0f948d544eaa6eae593c4c4dfc8840725665dc4cb0458df942242495f998c015999d117a17f3ae7751f01d7ecc0598c04141b295b92ff7d9b7
-
SSDEEP
12288:IqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Td:IqDEvCTbMWu7rQYlBQcBiT6rprG8aAd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 2084 chrome.exe 2084 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe Token: SeShutdownPrivilege 2084 chrome.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe 2084 chrome.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2084 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 30 PID 1884 wrote to memory of 2084 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 30 PID 1884 wrote to memory of 2084 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 30 PID 1884 wrote to memory of 2084 1884 4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe 30 PID 2084 wrote to memory of 1732 2084 chrome.exe 31 PID 2084 wrote to memory of 1732 2084 chrome.exe 31 PID 2084 wrote to memory of 1732 2084 chrome.exe 31 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2896 2084 chrome.exe 33 PID 2084 wrote to memory of 2756 2084 chrome.exe 34 PID 2084 wrote to memory of 2756 2084 chrome.exe 34 PID 2084 wrote to memory of 2756 2084 chrome.exe 34 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35 PID 2084 wrote to memory of 2184 2084 chrome.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe"C:\Users\Admin\AppData\Local\Temp\4b1fe6c41efb79a68ecfcf006f65fd265e9c8827a84043283480e52bfb73ab09.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f99758,0x7fef6f99768,0x7fef6f997783⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:23⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1560 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:83⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1656 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:83⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2124 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:13⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1648 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:13⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2808 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:23⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3184 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:13⤵PID:276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:83⤵PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:83⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 --field-trial-handle=1276,i,7073659661045390134,11717566985548186364,131072 --disable-features=CrashRecovery /prefetch:83⤵PID:1628
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD5432966579a9857868cdae1da3dd21503
SHA15ed67e7826d8a9f6d384ac89846a4af940436aca
SHA2569dc05b9e08078fbca3853ab9e6f96875d8ab2577218ffce6b1d7580bc5290658
SHA512fdbe5907a80f93b14d4bf35979b40fc5f9c81565659e05a74ca42005ba0b07ab5a92cab933e0bdb56500a102e5d387a8e829aed2b14eabf824583fb1f5fa9cfa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9c81277f-ddb0-4ebf-bdff-c0a642c1c2d6.tmp
Filesize6KB
MD51068224da74348b47c18662814a69bb8
SHA1ba963e7e324b449b7a0b41d2bc7d81e6b312d40a
SHA25614262a2b2dabf14ecf94e288cf5259bd2ffe76df83e320ed3918acdfce5602e3
SHA5124fd55432b78e69ab783b14baa321b57d98878f5c38aa7b07958236b9adba1214aeadd0d3f4213968c6ab04bf278065372c87df655217f1cd47a9bb4f7b07fafc
-
Filesize
2KB
MD5cc2a85019c665c261faf45076a6d8fc1
SHA12230c3ff9775397f257683b5dcee5a9ebcb2be5d
SHA256f50cccb4e87da5dc5da4e64e51fc8d5f4b6628b2ab0cda6d8ce2160e6b6d4618
SHA5120f5b617a910725ff7a7a77ca39e225c423fa491ae9c20d847ab9188ecb124f7f42aaa05e1d0195accd40b5993d6ab0e50922deddfcd8279cc9c06f11e11a268d
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
170KB
MD57ccbaa83d3ffebe0ca627e7df99a970e
SHA10c30e236f70f0cacbbc51ce20c47193ae4f3abb0
SHA2567f13b685bb5fa008543bc90f54ff3ed8c2fe2a8065fbc7b183253b24175d577f
SHA5128322b2dc93844955335c3b96227339ff7173f97fa5bc5774e2a9754dc3b6f7cb04754e36b3324f0d616e82e100c49134d8850adb2b2651a1c0b756f0a16cb154
-
Filesize
374KB
MD5c4536572a0e301268e2fc9cccfbf8f87
SHA1b6a9e4dfb59ccf05c26694a7ba4a394bb0c1dccb
SHA256b3ef9271b217a87c704c666f4b11d0b75ea8ffb46b46045daf12987269798bd0
SHA512517c9c14c6ed39d889ef481c1c5582825738673852fe95db01d02151a151a64b704e0e8e81e646555bb27e7b6b2ff50c6374f69c8f7a574b83db0268b9dadd0a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58